Privacy Policy — Tropik

Version effective as of September 29, 2026
Last updated: September 29, 2026

This Privacy Policy explains how Tropik SpA, Chilean tax ID (RUT) 77.729.156-4 (“Tropik”, “we”, “us”), processes personal data when you visit https://tropik.app, use our web, desktop, or mobile applications, or contract our omnichannel messaging services (together, the “Platform” or the “Services”).

Please read this document together with our Terms and Conditions. If you do not agree, do not use the Platform.

1. Data controller and contact

To exercise rights or submit privacy inquiries, write to privacidad@tropik.app (suggested subject: “Privacy request”). We will respond within the applicable legal time limits (in Chile, generally 30 calendar days, extendable as provided by law; under the GDPR, normally one month).

If in the future we appoint a Data Protection Officer or another formal contact point before Chile’s Personal Data Protection Agency, we will update this Policy.

2. Scope and roles (important)

Tropik processes data in two distinct contexts:

2.1. When Tropik is the controller

We process data of:

• visitors to the marketing website;
• prospects and customers (billing accounts, contracts, collections);
• account users (agents, administrators, workspace owners);
• support contacts and Tropik’s own commercial communications.

2.2. When Tropik is the processor for the Customer

When using the omnichannel Platform, the Customer (your company) is typically the controller of the data of its own end customers, leads, and conversations (“Customer Content”: WhatsApp, Instagram, email, chat messages, attachments, conversation metadata, etc.).

In that case Tropik processes Customer Content on behalf of and according to the instructions of the Customer, pursuant to the contract, a data processing agreement (DPA) where applicable, and applicable law. The Customer’s privacy policies govern vis-à-vis those data subjects; Tropik does not decide the Customer’s marketing or sales purposes.

If you are an end consumer who chatted with a brand through Tropik, exercise your rights with that brand (the controller). We may help the Customer fulfill those requests.

3. Legal framework

This Policy is prepared taking into account, among other rules:

• Chile: Law No. 19.628 on protection of private life / personal data, as amended by Law No. 21.719 (Personal Data Protection Agency and new obligations regime), whose full entry into force is set, absent legislative change, for December 1, 2026, and any regulations or Agency instructions issued thereafter.
• European Union / EEA / United Kingdom (where applicable): Regulation (EU) 2016/679 (GDPR) and, where relevant, the UK GDPR.
• Other local laws that may apply depending on your location or the Customer’s.

Where a rule is more protective of the data subject, we will apply that standard to the extent legally required of us.

4. What data we process

We collect only what is necessary for each purpose. Typical categories are:

4.1. Account and billing data (controller: Tropik)

• Identification and contact: name, email, phone, role, company.
• Tax and billing data: RUT/RUN or other tax ID, address, commercial activity, when needed to issue tax documents or enter into the contract.
• Access credentials (passwords stored encrypted via hash; we do not see them in clear text).
• Language preferences, time zone, and workspace settings.
• Subscription, payment, and collections history.

Payments: card data and other payment methods are processed by payment providers (for example Stripe, Transbank, Khipu). Tropik does not store the full card number on its systems; it receives tokens or transaction confirmations depending on the provider.

4.2. Product and website usage data

• Technical logs: IP address, device/browser type, operating system, session identifiers, access dates and times, pages visited, product events (for example sign-in, errors).
• Aggregated performance and security metrics.

4.3. Customer Content (processor: Tropik)

Depending on the channels the Customer connects: messages, files, histories, templates, tags, internal notes, recordings or transcripts if the Customer enables those features, and data that interlocutors voluntarily send in the conversation.

Tropik does not deliberately request especially sensitive data (health, ethnic origin, beliefs, biometric data, etc.). If the Customer or an end user includes them in a conversation, they will be processed only as part of the contracted service and under the Customer’s responsibility as to lawfulness.

4.4. Integrations

If the Customer connects third-party services (Meta, Google, Trello, OpenAI, or others), we receive the tokens and data that integration provides to operate the enabled feature. The Customer may revoke the connection from the Platform or from the third party’s console.

4.5. Communications

Content of emails or tickets sent to support, and marketing preference records (opt-in/opt-out).

4.6. Data we do not purposely collect

We do not target the Platform at minors. We do not create credit profiles of the Customer’s end consumers for purposes unrelated to the service. We do not sell data-subject databases.

5. Lawful bases (not only “consent”)

Depending on the case, we rely on one or more of these bases:

Mere use of the site or generic acceptance of terms does not replace consent when the law requires a clear and specific action (for example, marketing cookies or promotional communications).

6. Purposes of processing

6.1. Services and account

Provide, maintain, and improve the Platform; authenticate users; apply permissions; sync channels; generate operational workspace reports.

6.2. Billing and collections

Manage subscriptions, payments, reminders, and legitimate collection of debts arising from the contract, directly or through processors.

6.3. Security and quality

Detect incidents, abuse, spam, or misuse; audit access; support service continuity.

6.4. Service communications

Security notices, material changes to terms or privacy, incidents, and operational product updates.

6.5. Marketing (optional)

Send Tropik news, invitations, or promotions only if we have a valid basis (consent or, where the law allows, legitimate interest with a right to object). You may always unsubscribe.

6.6. Artificial intelligence features

If the Customer enables AI features (for example drafts, summaries, or intent detection), Customer Content may be sent to model providers solely for that enabled feature, under contract and security measures. We do not use Customer Content to train generalized models of Tropik or of third parties, unless the Customer expressly enables an integration whose provider indicates different processing and the Customer accepts it in that integration.

6.7. Compliance and legal defense

Comply with the law and defend ourselves against claims or investigations.

We do not process data for purposes incompatible with the above without a new legal basis and, where required, prior notice.

7. Processors, providers, and integrations

We share data only with those who need to process it for the purposes of this Policy, under appropriate instructions or contracts (confidentiality, security, controlled sub-processing).

Typical provider categories:

• cloud infrastructure and hosting (for example AWS, DigitalOcean);
• real-time message delivery (for example Pusher);
• payment gateways (Stripe, Transbank, Khipu);
• messaging channels and APIs (Meta and other channel operators);
• productivity or support tools the Customer connects (for example Trello);
• AI providers when the Customer enables those features (for example OpenAI);
• professional advisors (legal, accounting) under professional secrecy;
• companies in the same corporate group, only if necessary to provide the service and with the same level of protection.

We will publish or keep available, where applicable, an updated list of relevant SaaS sub-processors. Material changes will be communicated under the contract or this Policy.

Responsibility: Tropik selects providers with reasonable security standards and enters into contractual agreements. That does not shift to the data subject the duty to choose providers; toward you we respond under the law and the contract for the processing we perform. Third-party sites or apps you link to have their own policies; review them before use.

8. International transfers

We may store or process data in Chile and in other countries where our providers operate (for example the United States or others).

Where the law so requires (Law 21.719, GDPR, or others), transfers will rely on valid mechanisms, such as:

• a country, sector, or organization recognized as adequate by the competent authority;
• standard contractual clauses / model clauses;
• binding corporate rules or other recognized instruments;
• specific legal exceptions (for example, necessity to perform a contract at the data subject’s request), used restrictively.

You may request more information about applicable safeguards by writing to privacidad@tropik.app.

9. Cookies and similar technologies

We use cookies and similar technologies on the website and, where applicable, in the web app:

You may manage non-essential cookies from the site banner or preferences (when available) and from your browser settings. Blocking necessary cookies may prevent sign-in or critical features.

If the site uses reCAPTCHA or other Google services, that provider’s policies also apply.

10. Retention

We retain data only as long as needed for the purpose and then delete or anonymize it, unless a longer legal obligation applies.

General guidance (may vary by contract or law):

• Account and billing: while the relationship is active and, afterward, the tax and limitation periods applicable in Chile.
• Security and access logs: typically between 6 and 24 months, unless an investigation is ongoing.
• Customer Content: according to retention configured by the Customer and the contract; upon service termination, it is deleted or made available to the Customer for export within the contractual period, unless legally blocked.
• Marketing: until consent is withdrawn or an objection is made.
• Cookies: according to their technical lifespan and the site’s cookie table.

Deleting an agent account does not always erase Customer Content from the workspace (that is controlled by the Customer’s administrator).

11. Security

We apply technical and organizational measures appropriate to the risk, including:

• encryption in transit (TLS) and, where applicable, encryption at rest;
• role-based access control and authentication (including 2FA when available);
• logical segregation of workspaces;
• audit logs and incident monitoring;
• backups and continuity procedures;
• minimization and training of staff with data access.

No system is 100% secure. If we become aware of a security breach affecting personal data with a reasonable risk to data subjects, we will notify the competent authority and, where applicable, data subjects or the Customer, without undue delay, in accordance with Law 21.719, the GDPR, and the contract.

12. Your rights

Depending on your location and role (data subject vis-à-vis Tropik as controller, or vis-à-vis the Customer when Tropik is processor), you may exercise:

12.1. Chile (Law 19.628 / Law 21.719 reform regime)

• Access to your data and information about the processing.
• Rectification of inaccurate or incomplete data.
• Erasure (cancellation) where applicable.
• Objection to processing based on legitimate interest or to certain uses (including marketing).
• Portability, where the law and technical feasibility allow.
• Temporary blocking in the cases provided (for example, while a dispute is resolved).
• Other rights recognized by the Personal Data Protection Agency.

12.2. GDPR / UK GDPR (if applicable)

In addition or in parallel: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority in your country. If Tropik were required to appoint an EU representative, their details will be published in this Policy.

12.3. How to exercise them

Send your request to privacidad@tropik.app with reasonable identification. If you act on behalf of another person, prove representation. If the request concerns Customer Content, say so: we will channel it to the responsible Customer or ask you to present it directly to them.

We do not charge for exercising rights, except for manifestly unfounded or excessive requests, on the terms the law allows.

You may also complain to Chile’s Personal Data Protection Agency (when operational under Law 21.719) or another competent authority.

13. Minors

The Platform is aimed at businesses and professionals. It is not intended for persons under 18 (or the minimum age in your country). We do not knowingly collect minors’ data. If we detect a minor’s account without a legal basis, we will close it and delete associated data to the extent possible.

14. Automated decisions

AI or routing features may suggest replies, prioritize conversations, or classify intents. We do not make automated decisions with significant legal effects on end consumers without adequate human involvement by the Customer. The Customer is responsible for how it uses those suggestions toward its end users.

15. Authorities and legal disclosures

We may disclose data if the law requires it or if we in good faith believe it is necessary to protect the rights, security, or integrity of Tropik, users, or third parties. Where the law allows, we will notify the Customer or the affected data subject before or after the disclosure.

16. Changes to this Policy

We may update this Policy to reflect changes in the service or the law. The current version is published at https://tropik.app/privacidad with its date. If the change is material, we will notify the administrative account by email, via a notice in the Platform, or, where the law requires, seek new consent.

Continued use of the service after an updated version takes effect implies awareness of that version, without prejudice to rights that cannot be waived.

17. Contact

Tropik SpA — Chilean tax ID (RUT) 77.729.156-4
Privacy: privacidad@tropik.app
Support: soporte@tropik.app
Web: https://tropik.app